shieldcortex 2.20.0 → 3.0.0

package/dist/api/visualization-server.js

@@ -13,7 +13,7 @@ import { generateSessionToken, cleanupSessionToken, validateSessionToken, getSes
 import { WebSocketServer, WebSocket } from 'ws';
 import { getDatabase, initDatabase, checkpointWal } from '../database/init.js';
 import { DEFAULT_CONFIG } from '../memory/types.js';
-import { searchMemories, getRecentMemories, getHighPriorityMemories, getMemoryStats, getMemoryById, addMemory, deleteMemory, accessMemory, updateDecayScores, updateMemory, promoteMemory, createMemoryLink, rowToMemory, } from '../memory/store.js';
+import { searchMemories, searchMemoriesExplained, getRecentMemories, getHighPriorityMemories, getMemoryStats, getMemoryById, addMemory, deleteMemory, accessMemory, updateDecayScores, updateMemory, promoteMemory, createMemoryLink, rowToMemory, } from '../memory/store.js';
 import { consolidate, generateContextSummary, formatContextSummary, } from '../memory/consolidate.js';
 import { calculateDecayedScore } from '../memory/decay.js';
 import { getActivationStats, getActiveMemories } from '../memory/activation.js';
@@ -25,7 +25,7 @@ import { pause, resume, getControlStatus, isKillSwitchActive, getKillSwitchMeta,
 import { getCurrentVersion, getRunningVersion, checkForUpdates, performUpdate, scheduleRestart } from './version.js';
 import { runDefencePipeline } from '../defence/pipeline.js';
 import { DEFAULT_DEFENCE_CONFIG } from '../defence/types.js';
-import { queryAuditLogs, getAuditStats, queryAgentRegistry, queryAgentTimeline, queryAgentOperations } from '../defence/audit/queries.js';
+import { queryAuditLogs, getAuditStats, queryAgentRegistry, queryAgentTimeline, queryAgentOperations, queryIncidentReplay } from '../defence/audit/queries.js';
 import { logAudit } from '../defence/audit/index.js';
 import { getCloudConfig, setCloudConfig, readRawConfig, getTrustedSkills, addTrustedSkill, removeTrustedSkill, getDeviceId, getDeviceName, getDefenceMode, setDefenceMode, isConfigTampered, getOpenClawMemoryConfig, setOpenClawMemoryConfig } from '../cloud/config.js';
 import { getQueueStats } from '../cloud/sync-queue.js';
@@ -281,6 +281,41 @@ export function startVisualizationServer(dbPath) {
             res.status(500).json({ error: error.message });
         }
     });
+    // Explain why memories ranked for a recall query.
+    // Read-only: uses the same scoring logic as search without reinforcement side effects.
+    app.get('/api/recall/explain', requireNotLocked, async (req, res) => {
+        try {
+            const query = typeof req.query.query === 'string' ? req.query.query.trim() : '';
+            if (!query) {
+                return res.status(400).json({ error: 'query is required' });
+            }
+            const project = typeof req.query.project === 'string' ? req.query.project : undefined;
+            const type = typeof req.query.type === 'string' ? req.query.type : undefined;
+            const category = typeof req.query.category === 'string' ? req.query.category : undefined;
+            const limit = Math.min(parseInt(req.query.limit, 10) || 10, 50);
+            const includeDecayed = req.query.includeDecayed === 'true';
+            const includeGlobal = req.query.includeGlobal !== 'false';
+            const results = await searchMemoriesExplained({
+                query,
+                project,
+                type: type,
+                category: category,
+                limit,
+                includeDecayed,
+                includeGlobal,
+            });
+            res.json({
+                query,
+                project: project ?? null,
+                total: results.length,
+                sideEffects: 'disabled',
+                results,
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     // Get single memory by ID
     app.get('/api/memories/:id', requireNotLocked, (req, res) => {
         try {
@@ -1848,6 +1883,36 @@ export function startVisualizationServer(dbPath) {
             res.status(500).json({ error: error.message });
         }
     });
+    // Incident replay — reconstruct a best-effort timeline from audit, quarantine, and persisted events.
+    app.get('/api/v1/incidents/replay', (req, res) => {
+        try {
+            const limit = Math.min(parseInt(req.query.limit, 10) || 200, 500);
+            const startTime = typeof req.query.startTime === 'string' ? req.query.startTime : undefined;
+            const endTime = typeof req.query.endTime === 'string' ? req.query.endTime : undefined;
+            const project = typeof req.query.project === 'string' ? req.query.project : undefined;
+            const sourceIdentifier = typeof req.query.sourceIdentifier === 'string' ? req.query.sourceIdentifier : undefined;
+            const memoryId = req.query.memoryId ? parseInt(req.query.memoryId, 10) : undefined;
+            const events = queryIncidentReplay({
+                startTime,
+                endTime,
+                project,
+                sourceIdentifier,
+                memoryId,
+                limit,
+            });
+            res.json({
+                events,
+                total: events.length,
+                coverage: {
+                    sources: ['defence_audit', 'quarantine', 'events'],
+                    note: 'Replay is best-effort. Durable audit and quarantine history is complete; generic event coverage depends on the retained events table window.',
+                },
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     // Agent registry — distinct agents aggregated from audit logs
     app.get('/api/v1/agents', (req, res) => {
         try {
@@ -1947,6 +2012,56 @@ export function startVisualizationServer(dbPath) {
             res.status(500).json({ error: error.message });
         }
     });
+    // Bulk approve quarantined items
+    app.post('/api/v1/quarantine/bulk-approve', requireNotLocked, (req, res) => {
+        try {
+            const db = getDatabase();
+            const ids = req.body?.ids;
+            if (!Array.isArray(ids) || ids.length === 0) {
+                return res.status(400).json({ error: 'ids must be a non-empty array of numbers' });
+            }
+            const reviewedBy = req.body?.reviewedBy ?? 'dashboard';
+            const now = new Date().toISOString();
+            const stmt = db.prepare('UPDATE quarantine SET status = ?, reviewed_at = ?, reviewed_by = ? WHERE id = ? AND status = ?');
+            let updated = 0;
+            const txn = db.transaction(() => {
+                for (const id of ids) {
+                    const result = stmt.run('approved', now, reviewedBy, id, 'pending');
+                    updated += result.changes;
+                }
+            });
+            txn();
+            res.json({ success: true, updated, total: ids.length });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    // Bulk reject quarantined items
+    app.post('/api/v1/quarantine/bulk-reject', requireNotLocked, (req, res) => {
+        try {
+            const db = getDatabase();
+            const ids = req.body?.ids;
+            if (!Array.isArray(ids) || ids.length === 0) {
+                return res.status(400).json({ error: 'ids must be a non-empty array of numbers' });
+            }
+            const reviewedBy = req.body?.reviewedBy ?? 'dashboard';
+            const now = new Date().toISOString();
+            const stmt = db.prepare('UPDATE quarantine SET status = ?, reviewed_at = ?, reviewed_by = ? WHERE id = ? AND status = ?');
+            let updated = 0;
+            const txn = db.transaction(() => {
+                for (const id of ids) {
+                    const result = stmt.run('rejected', now, reviewedBy, id, 'pending');
+                    updated += result.changes;
+                }
+            });
+            txn();
+            res.json({ success: true, updated, total: ids.length });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     // Retroactive sync: push existing quarantine items to cloud
     app.post('/api/quarantine/sync-to-cloud', requireNotLocked, async (_req, res) => {
         try {
@@ -2558,4 +2673,3 @@ export function startVisualizationServer(dbPath) {
     `);
     });
 }
-//# sourceMappingURL=visualization-server.js.map

package/dist/audit/env-scanner.d.ts

@@ -12,4 +12,3 @@ import type { ScannerResult } from './types.js';
  * Run the environment secrets scanner.
  */
 export declare function scanEnvFiles(): ScannerResult;
-//# sourceMappingURL=env-scanner.d.ts.map

package/dist/audit/env-scanner.js

@@ -203,4 +203,3 @@ export function scanEnvFiles() {
         durationMs: Date.now() - start,
     };
 }
-//# sourceMappingURL=env-scanner.js.map

package/dist/audit/index.d.ts

@@ -11,4 +11,3 @@ export { scanRulesFiles } from './rules-file-scanner.js';
 export { formatTerminalReport, formatMarkdownReport, formatJsonReport } from './report-formatter.js';
 export { calculateGrade } from './types.js';
 export type { AuditFinding, AuditReport, AuditGrade, AuditSeverity, ScannerResult, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.js

@@ -10,4 +10,3 @@ export { scanEnvFiles } from './env-scanner.js';
 export { scanRulesFiles } from './rules-file-scanner.js';
 export { formatTerminalReport, formatMarkdownReport, formatJsonReport } from './report-formatter.js';
 export { calculateGrade } from './types.js';
-//# sourceMappingURL=index.js.map

package/dist/audit/mcp-config-scanner.d.ts

@@ -11,4 +11,3 @@ import type { ScannerResult } from './types.js';
  * Run the MCP config scanner.
  */
 export declare function scanMcpConfigs(): ScannerResult;
-//# sourceMappingURL=mcp-config-scanner.d.ts.map

package/dist/audit/mcp-config-scanner.js

@@ -174,4 +174,3 @@ export function scanMcpConfigs() {
         durationMs: Date.now() - start,
     };
 }
-//# sourceMappingURL=mcp-config-scanner.js.map

package/dist/audit/memory-scanner.d.ts

@@ -12,4 +12,3 @@ import type { ScannerResult } from './types.js';
  * Run the memory scanner.
  */
 export declare function scanMemories(): ScannerResult;
-//# sourceMappingURL=memory-scanner.d.ts.map

package/dist/audit/memory-scanner.js

@@ -202,4 +202,3 @@ export function scanMemories() {
         durationMs: Date.now() - start,
     };
 }
-//# sourceMappingURL=memory-scanner.js.map

package/dist/audit/report-formatter.d.ts

@@ -21,4 +21,3 @@ export declare function formatMarkdownReport(report: AuditReport): string;
  * Format an audit report as JSON (for programmatic consumption).
  */
 export declare function formatJsonReport(report: AuditReport): string;
-//# sourceMappingURL=report-formatter.d.ts.map

package/dist/audit/report-formatter.js

@@ -234,4 +234,3 @@ export function formatMarkdownReport(report) {
 export function formatJsonReport(report) {
     return JSON.stringify(report, null, 2);
 }
-//# sourceMappingURL=report-formatter.js.map

package/dist/audit/rules-file-scanner.d.ts

@@ -14,4 +14,3 @@ import type { ScannerResult } from './types.js';
  * Run the rules file scanner.
  */
 export declare function scanRulesFiles(): ScannerResult;
-//# sourceMappingURL=rules-file-scanner.d.ts.map

package/dist/audit/rules-file-scanner.js

@@ -173,4 +173,3 @@ export function scanRulesFiles() {
         durationMs: Date.now() - start,
     };
 }
-//# sourceMappingURL=rules-file-scanner.js.map

package/dist/audit/types.d.ts

@@ -64,4 +64,3 @@ export interface AuditReport {
  * F = critical findings present
  */
 export declare function calculateGrade(bySeverity: Record<AuditSeverity, number>): AuditGrade;
-//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.js

@@ -24,4 +24,3 @@ export function calculateGrade(bySeverity) {
         return 'B';
     return 'A';
 }
-//# sourceMappingURL=types.js.map

package/dist/cli/audit.d.ts

@@ -14,4 +14,3 @@
  * Run the full audit.
  */
 export declare function handleAuditCommand(args: string[]): Promise<void>;
-//# sourceMappingURL=audit.d.ts.map

package/dist/cli/audit.js

@@ -128,4 +128,3 @@ export async function handleAuditCommand(args) {
         process.exit(grade === 'A' || grade === 'B' ? 0 : 1);
     }
 }
-//# sourceMappingURL=audit.js.map

package/dist/cli/doctor.d.ts

@@ -3,4 +3,3 @@
  * Runs diagnostics and reports issues with actionable fixes.
  */
 export declare function runDoctor(): Promise<void>;
-//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.js

@@ -466,4 +466,3 @@ export async function runDoctor() {
     }
     console.log('');
 }
-//# sourceMappingURL=doctor.js.map

package/dist/cli/iron-dome.d.ts

@@ -13,4 +13,3 @@
  * Handle the `iron-dome` subcommand.
  */
 export declare function handleIronDomeCommand(args: string[]): Promise<void>;
-//# sourceMappingURL=iron-dome.d.ts.map

package/dist/cli/iron-dome.js

@@ -284,4 +284,3 @@ function handleConfirmation(args) {
     console.error('Available: list, move, add, remove');
     process.exit(1);
 }
-//# sourceMappingURL=iron-dome.js.map

package/dist/cloud/cli.d.ts

@@ -1,2 +1 @@
 export declare function handleCloudConfig(args: string[]): void;
-//# sourceMappingURL=cli.d.ts.map

package/dist/cloud/cli.js

@@ -128,4 +128,3 @@ export function handleCloudConfig(args) {
         console.log('  --verify-timeout <ms>  Set verify timeout in ms (1000-30000)');
     }
 }
-//# sourceMappingURL=cli.js.map

package/dist/cloud/config.d.ts

@@ -94,4 +94,3 @@ export declare function getDeviceId(): string;
  * Stores in config on first call; reads from config thereafter.
  */
 export declare function getDeviceName(): string;
-//# sourceMappingURL=config.d.ts.map

package/dist/cloud/config.js

@@ -272,7 +272,7 @@ export function getOpenClawMemoryConfig() {
         ? Math.floor(clamp(raw.openclawAutoMemoryMaxRecent, 50, 1000))
         : DEFAULT_OPENCLAW_MEMORY_CONFIG.maxRecent;
     return {
-        autoMemory: raw.openclawAutoMemory !== false,
+        autoMemory: raw.openclawAutoMemory === true,
         dedupe: raw.openclawAutoMemoryDedupe !== false,
         noveltyThreshold: threshold,
         maxRecent,
@@ -362,4 +362,3 @@ export function getDeviceName() {
     writeRawConfig(raw);
     return name;
 }
-//# sourceMappingURL=config.js.map

package/dist/cloud/iron-dome-sync.d.ts

@@ -35,4 +35,3 @@ export declare function refreshCloudIronDome(): Promise<void>;
  * Called once during initialisation.
  */
 export declare function applyCachedCloudPatterns(): void;
-//# sourceMappingURL=iron-dome-sync.d.ts.map

package/dist/cloud/iron-dome-sync.js

@@ -114,4 +114,3 @@ export function applyCachedCloudPatterns() {
         setExternalPatterns(cache.patterns);
     }
 }
-//# sourceMappingURL=iron-dome-sync.js.map

package/dist/cloud/quarantine-sync.d.ts

@@ -15,4 +15,3 @@ export declare function syncQuarantineToCloud(entry: {
     anomaly_score: number;
     firewall_result: string;
 }): void;
-//# sourceMappingURL=quarantine-sync.d.ts.map

package/dist/cloud/quarantine-sync.js

@@ -51,4 +51,3 @@ export function syncQuarantineToCloud(entry) {
     })
         .finally(() => clearTimeout(timeout));
 }
-//# sourceMappingURL=quarantine-sync.js.map

package/dist/cloud/sync-queue.d.ts

@@ -69,4 +69,3 @@ export declare function getQueueStats(): QueueStats;
  * Returns the number of rows deleted.
  */
 export declare function purgeOldEntries(): number;
-//# sourceMappingURL=sync-queue.d.ts.map

package/dist/cloud/sync-queue.js

@@ -195,4 +195,3 @@ export function purgeOldEntries() {
   `).run(cutoff);
     return result.changes;
 }
-//# sourceMappingURL=sync-queue.js.map

package/dist/cloud/sync.d.ts

@@ -22,4 +22,3 @@ export declare function sendKillSwitchAlert(meta: {
     memoryCountAtTrigger?: number;
     triggeredAt: string;
 }): void;
-//# sourceMappingURL=sync.d.ts.map

package/dist/cloud/sync.js

@@ -127,4 +127,3 @@ export function sendKillSwitchAlert(meta) {
         .then(() => { clearTimeout(timeoutId); })
         .catch(() => { clearTimeout(timeoutId); });
 }
-//# sourceMappingURL=sync.js.map

package/dist/cloud/verify.d.ts

@@ -20,4 +20,3 @@ export declare function submitVerification(content: string, title: string, pipel
  * Poll for verification result by ID.
  */
 export declare function pollVerification(id: number): Promise<VerifyResult | null>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/cloud/verify.js

@@ -110,4 +110,3 @@ export async function pollVerification(id) {
         return null;
     }
 }
-//# sourceMappingURL=verify.js.map

package/dist/context/project-context.d.ts

@@ -54,4 +54,3 @@ export declare function getProjectContextInfo(): {
     source: 'env' | 'cwd' | 'none';
     isGlobal: boolean;
 };
-//# sourceMappingURL=project-context.d.ts.map

package/dist/context/project-context.js

@@ -132,4 +132,3 @@ export function getProjectContextInfo() {
         isGlobal: activeProject === null,
     };
 }
-//# sourceMappingURL=project-context.js.map

package/dist/database/init.d.ts

@@ -60,4 +60,3 @@ export declare function withTransaction<T>(fn: () => T): T;
  * Use this for critical operations that must not conflict with concurrent writes
  */
 export declare function withImmediateTransaction<T>(fn: () => T): T;
-//# sourceMappingURL=init.d.ts.map

package/dist/database/init.js

@@ -931,4 +931,3 @@ export function withImmediateTransaction(fn) {
         throw e;
     }
 }
-//# sourceMappingURL=init.js.map

package/dist/defence/audit/export.d.ts

@@ -3,4 +3,3 @@
  */
 export declare function exportAuditJSON(startTime?: string, endTime?: string): string;
 export declare function exportAuditCSV(startTime?: string, endTime?: string): string;
-//# sourceMappingURL=export.d.ts.map

package/dist/defence/audit/export.js

@@ -40,4 +40,3 @@ export function exportAuditCSV(startTime, endTime) {
     const rows = logs.map(row => headers.map(h => escapeCSV(row[h])).join(','));
     return [headers.join(','), ...rows].join('\n');
 }
-//# sourceMappingURL=export.js.map

package/dist/defence/audit/index.d.ts

@@ -1,4 +1,3 @@
 export { logAudit, createContentHash } from './logger.js';
 export { queryAuditLogs, getAuditStats, queryAgentRegistry, queryAgentTimeline, queryAgentOperations } from './queries.js';
 export type { AuditQueryOptions, AuditStats, AgentInfo, AgentTimelinePoint } from './queries.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/audit/index.js

@@ -1,3 +1,2 @@
 export { logAudit, createContentHash } from './logger.js';
 export { queryAuditLogs, getAuditStats, queryAgentRegistry, queryAgentTimeline, queryAgentOperations } from './queries.js';
-//# sourceMappingURL=index.js.map

package/dist/defence/audit/logger.d.ts

@@ -11,4 +11,3 @@ export declare function logAudit(entry: Omit<AuditEntry, 'id'>): number;
  * Create a SHA-256 hash of content for integrity verification.
  */
 export declare function createContentHash(content: string): string;
-//# sourceMappingURL=logger.d.ts.map

package/dist/defence/audit/logger.js

@@ -54,4 +54,3 @@ export function logAudit(entry) {
 export function createContentHash(content) {
     return createHash('sha256').update(content, 'utf-8').digest('hex');
 }
-//# sourceMappingURL=logger.js.map

package/dist/defence/audit/queries.d.ts

@@ -39,6 +39,27 @@ export interface AuditStats {
     }[];
     threatBreakdown: Record<string, number>;
 }
+export interface IncidentReplayOptions {
+    startTime?: string;
+    endTime?: string;
+    project?: string;
+    sourceIdentifier?: string;
+    memoryId?: number;
+    limit?: number;
+}
+export interface IncidentReplayEntry {
+    timestamp: string;
+    type: 'audit' | 'quarantine' | 'event';
+    eventType: string;
+    severity: 'info' | 'warning' | 'critical';
+    summary: string;
+    details?: string | null;
+    source?: string;
+    memoryId?: number | null;
+    auditId?: number | null;
+    quarantineId?: number | null;
+    metadata?: Record<string, unknown>;
+}
 /**
  * Query audit logs with flexible filters.
  */
@@ -64,4 +85,4 @@ export declare function queryAgentOperations(identifier: string, options?: {
     firewallResult?: FirewallResult;
     project?: string;
 }): AuditEntry[];
-//# sourceMappingURL=queries.d.ts.map
+export declare function queryIncidentReplay(options?: IncidentReplayOptions): IncidentReplayEntry[];